<html>
<head><meta charset="utf-8"><title>Exactly how evil is pointer arith? · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html">Exactly how evil is pointer arith?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="241671209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241671209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241671209">(Jun 06 2021 at 04:10)</a>:</h4>
<p>Hello, if I have a slice of primitives obtained from valid Rust and I am determined to ignore builtin pointer methods, how many conniption fits does our compilation model have if I take the base pointer and then do pointer arithmetic to find items and read them, assuming my math is flawless and never leaves bounds? I know I could get stronger opts from using stuff like fn offset, and I know provenance makes things... Complicated... I just want to know more, because there are other conditions in my case that may make doing raw arithmetic somewhat compelling.</p>



<a name="241671272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241671272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241671272">(Jun 06 2021 at 04:11)</a>:</h4>
<p>I think that's basically the same as <code>wrapping_offset</code>, so maybe see what that talks about? <a href="https://doc.rust-lang.org/nightly/std/primitive.pointer.html#method.wrapping_offset">https://doc.rust-lang.org/nightly/std/primitive.pointer.html#method.wrapping_offset</a></p>



<a name="241671313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241671313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241671313">(Jun 06 2021 at 04:12)</a>:</h4>
<p>Yeh, that is my current working assumption.</p>



<a name="241680394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241680394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241680394">(Jun 06 2021 at 08:27)</a>:</h4>
<p><span class="user-mention" data-user-id="281757">@Jubilee</span> it's a bit hard to say without concrete code, but in general if you have <code>x: &amp;mut [i32]</code>, and then do <code>x.as_mut_ptr()</code>, you are free to do ptr arithmetic on that raw pointer <em>within the bounds of the slice</em> (i.e., the length stored in the wide ptr <code>x</code> matters) as much as you want.  However, you must not use <code>x</code> any more -- the moment you use <code>x</code> again, all raw ptrs and everything transitively derived from them becomes invalid.</p>



<a name="241680450"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241680450" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241680450">(Jun 06 2021 at 08:28)</a>:</h4>
<p>However, I am confused by "basically the same as wrapping_offset" -- if by "pointer arithmetic" you don't mean "wrapping_offset"/"offset", then what do you mean?</p>



<a name="241693656"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241693656" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241693656">(Jun 06 2021 at 14:08)</a>:</h4>
<p>I mean that I don't want to individually call wrapping_offset four times on four pointers, I would like to cast the values into raw integers so I can do math on four integers at once, then cast back to pointers and read them. :^)</p>



<a name="241694428"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241694428" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241694428">(Jun 06 2021 at 14:27)</a>:</h4>
<p>that number "four" suspiciously sounds like simd</p>



<a name="241695774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241695774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241695774">(Jun 06 2021 at 15:02)</a>:</h4>
<p>Doing pointer arithmetic as integers is <em>fun</em>. If you ask me, <code>(p as usize)+4 as *mut T</code> is equivalent to <code>p.cast::&lt;u8&gt;().wrapping_add(4).cast::&lt;T&gt;()</code>, but idk what llvm will say (and the latter is fairly important).</p>



<a name="241696393"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241696393" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241696393">(Jun 06 2021 at 15:17)</a>:</h4>
<p>LLVM doesn't particularly care about the pointed-to types. It is more about the underlying objects, and how they are accessed (i.e. whether the access is aligned)</p>



<a name="241698683"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241698683" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241698683">(Jun 06 2021 at 16:16)</a>:</h4>
<p><span class="user-mention silent" data-user-id="281757">Jubilee</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F/near/241693656">said</a>:</p>
<blockquote>
<p>I mean that I don't want to individually call wrapping_offset four times on four pointers, I would like to cast the values into raw integers so I can do math on four integers at once, then cast back to pointers and read them. :^)</p>
</blockquote>
<p>oh... that's not pointer arithmetic (in my book), that's integer arithmetic and integer-ptr casts. That is truly evil. ;)</p>



<a name="241699827"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241699827" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241699827">(Jun 06 2021 at 16:46)</a>:</h4>
<p>but if you follow what I said above in terms of aliasing, you should be fine -- just make sure to do <code>slice.as_mut_ptr() as usize</code> to get a ptr that is valid for the entire slice, and turn that  into an int</p>



<a name="241699830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241699830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241699830">(Jun 06 2021 at 16:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="257758">Connor Horman</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F/near/241695774">said</a>:</p>
<blockquote>
<p>Doing pointer arithmetic as integers is <em>fun</em>. If you ask me, <code>(p as usize)+4 as *mut T</code> is equivalent to <code>p.cast::&lt;u8&gt;().wrapping_add(4).cast::&lt;T&gt;()</code>, but idk what llvm will say (and the latter is fairly important).</p>
</blockquote>
<p>it's certainly not equivalent due to provenance issues (in particular, <code>wrapping_add</code> cannot be used to create a valid ptr across allocation boundaries)</p>



<a name="241699836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241699836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241699836">(Jun 06 2021 at 16:46)</a>:</h4>
<p>round-tripping through integers loses provenance; <code>wrapping_offset</code> preserves provenance</p>



<a name="241701471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701471">(Jun 06 2021 at 17:26)</a>:</h4>
<p>Alright! I am definitely doing that (well, specifically I am using <code>slice.as_ptr()</code> when only reading and <code>mutable_slice.as_mut_ptr()</code> when writing), so we're good then.<br>
Ideally I would have a way to assert I am preserving provenance while still doing SIMD math on pointers, but atm I don't care too much. This is an MVP, baby!</p>



<a name="241701705"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701705" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701705">(Jun 06 2021 at 17:32)</a>:</h4>
<p>in my dream world, we'd replace <code>int as *mut T</code> by an operation <code>int_to_ptr_with_provenance(addr: usize, provenance: *mut T) -&gt; *mut T</code>, so you could explicitly define the provenance of he new ptr, and moreover you would be <em>forced</em> to do so</p>



<a name="241701713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701713">(Jun 06 2021 at 17:32)</a>:</h4>
<p>that would solve basically all the problems that integer-pointer-casts are causing in formal memory models^^</p>



<a name="241701736"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701736" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701736">(Jun 06 2021 at 17:33)</a>:</h4>
<p>(we can in fact implement this operation in rust, but as long as the no-provenance cast also still exists, that doesn't help simplify anything)</p>



<a name="241701778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701778">(Jun 06 2021 at 17:34)</a>:</h4>
<p>Yeah, there's a reason I'm not even exposing integer-to-ptr casts directly to users in our MVP API, tbh.</p>



<a name="241701787"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701787" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701787">(Jun 06 2021 at 17:34)</a>:</h4>
<p>yeah that sounds like it'd be crazy hard to use correctly^^</p>



<a name="241701788"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701788" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701788">(Jun 06 2021 at 17:34)</a>:</h4>
<p>Just the safe version that has <strong>my</strong> demonic power in the code. <span aria-label="smiling imp" class="emoji emoji-1f608" role="img" title="smiling imp">:smiling_imp:</span></p>



<a name="241701800"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701800" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701800">(Jun 06 2021 at 17:35)</a>:</h4>
<blockquote>
<p>Alright! I am definitely doing that (well, specifically I am using slice.as_ptr() when only reading and mutable_slice.as_mut_ptr() when writing), so we're good then.</p>
</blockquote>
<p>and not using the original <code>mutable_slice</code> <em>at all</em> until you are done with all the integers you got there, I hope :)</p>



<a name="241701806"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701806" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701806">(Jun 06 2021 at 17:35)</a>:</h4>
<p>oh yeah, it begins and ends inside the function.</p>



<a name="241701807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701807">(Jun 06 2021 at 17:35)</a>:</h4>
<p>what I mean is, even <code>mutable_slice.len()</code> is deadly</p>



<a name="241701847"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701847" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701847">(Jun 06 2021 at 17:36)</a>:</h4>
<p>I actually generate the mask first.</p>



<a name="241701853"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701853" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701853">(Jun 06 2021 at 17:36)</a>:</h4>
<p>not sure what that means, but the usual pattern is</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="n">len</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">mutable_slice</span><span class="p">.</span><span class="n">len</span><span class="p">();</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">mutable_slice</span><span class="p">.</span><span class="n">as_mut_ptr</span><span class="p">();</span><span class="w"></span>
<span class="c1">// now just use 'len'</span>
</code></pre></div>
<p>the order of these two <code>let</code> matters</p>



<a name="241701860"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701860" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701860">(Jun 06 2021 at 17:37)</a>:</h4>
<p>(in Stacked Borrows. there might be better aliasing models in the glorious future that are less sensitive.)</p>



<a name="241701864"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241701864" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241701864">(Jun 06 2021 at 17:37)</a>:</h4>
<p>yeah! Okay so the mask is the thing that is derived from <code>.len()</code>, and it tells me which of the pointers I'm about to create are going to be readable/writeable.</p>



<a name="241702153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241702153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241702153">(Jun 06 2021 at 17:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="123586">nagisa</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F/near/241696393">said</a>:</p>
<blockquote>
<p>LLVM doesn't particularly care about the pointed-to types. It is more about the underlying objects, and how they are accessed (i.e. whether the access is aligned)</p>
</blockquote>
<p>FWIW It looks like llvm doesn't auto-vectorize pointer addition: <a href="https://godbolt.org/z/fG65fb7PE">https://godbolt.org/z/fG65fb7PE</a></p>



<a name="241702205"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241702205" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241702205">(Jun 06 2021 at 17:46)</a>:</h4>
<p>And that is why I am bothering to do a vector add and pointer cast, yes.</p>



<a name="241702277"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241702277" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241702277">(Jun 06 2021 at 17:48)</a>:</h4>
<p>The actual reads/writes have all of Rust's usual safety guarantees in place because they're from/to a proper slice that the user has presumably obtained in a "lawful" way, and if they don't that's their problem. <span aria-label="upside down" class="emoji emoji-1f643" role="img" title="upside down">:upside_down:</span></p>



<a name="241703043"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241703043" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241703043">(Jun 06 2021 at 18:07)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F/near/241702153">said</a>:</p>
<blockquote>
<p>FWIW It looks like llvm doesn't auto-vectorize pointer addition: <a href="https://godbolt.org/z/fG65fb7PE">https://godbolt.org/z/fG65fb7PE</a></p>
</blockquote>
<p>Seems quite plausible. pointer offset is not an integer addition, its a gep(i), and that doesn't have a variant that would generate multiple results at once.</p>



<a name="241704177"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241704177" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241704177">(Jun 06 2021 at 18:30)</a>:</h4>
<p>well:</p>
<h3>‘getelementptr’ Instruction</h3>
<h4>Syntax:</h4>
<div class="codehilite" data-code-language="ABNF"><pre><span></span><code>&lt;<span class="nc">result</span>&gt; <span class="o">=</span> <span class="nc">getelementptr</span> &lt;<span class="nc">ty</span>&gt;, &lt;<span class="nc">ty</span>&gt;<span class="o">*</span> &lt;<span class="nc">ptrval</span>&gt;{, <span class="p">[</span><span class="nc">inrange</span><span class="p">]</span> &lt;<span class="nc">ty</span>&gt; &lt;<span class="nc">idx</span>&gt;}<span class="o">*</span>
&lt;<span class="nc">result</span>&gt; <span class="o">=</span> <span class="nc">getelementptr</span> <span class="nc">inbounds</span> &lt;<span class="nc">ty</span>&gt;, &lt;<span class="nc">ty</span>&gt;<span class="o">*</span> &lt;<span class="nc">ptrval</span>&gt;{, <span class="p">[</span><span class="nc">inrange</span><span class="p">]</span> &lt;<span class="nc">ty</span>&gt; &lt;<span class="nc">idx</span>&gt;}<span class="o">*</span>
&lt;<span class="nc">result</span>&gt; <span class="o">=</span> <span class="nc">getelementptr</span> &lt;<span class="nc">ty</span>&gt;, &lt;<span class="nc">ptr</span> <span class="nc">vector</span>&gt; &lt;<span class="nc">ptrval</span>&gt;, <span class="p">[</span><span class="nc">inrange</span><span class="p">]</span> &lt;<span class="nc">vector</span> <span class="nc">index</span> <span class="nc">type</span>&gt; &lt;<span class="nc">idx</span>&gt;
</code></pre></div>
<h4>Overview:</h4>
<p>The ‘getelementptr’ instruction is used to get the address of a subelement of an aggregate data structure. It performs address calculation only and does not access memory. The instruction <em>can also be used to calculate a vector of such addresses</em>.</p>



<a name="241704195"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241704195" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241704195">(Jun 06 2021 at 18:30)</a>:</h4>
<p>your 5s faster than me...I was just about to post that</p>



<a name="241704289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241704289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241704289">(Jun 06 2021 at 18:32)</a>:</h4>
<p>seems like we need <code>simd_wrapping_offset</code> and <code>simd_offset</code> intrinsics</p>



<a name="241705651"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241705651" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241705651">(Jun 06 2021 at 19:00)</a>:</h4>
<p><del>Might not need new intrinsics, just to make the existing ones work when passed vector types.</del></p>



<a name="241705707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241705707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241705707">(Jun 06 2021 at 19:00)</a>:</h4>
<p>Oh, never mind, offset takes <code>*const T</code>, not just <code>T</code>.  New ones, then.</p>



<a name="241705708"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241705708" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jubilee <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241705708">(Jun 06 2021 at 19:00)</a>:</h4>
<p>yeah, I was about to say. I am pretty sure pointer manipulation is its own particular internal intrinsic in rustc already.</p>



<a name="241707073"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241707073" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241707073">(Jun 06 2021 at 19:31)</a>:</h4>
<p>huh, first time I see this</p>



<a name="241707163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241707163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241707163">(Jun 06 2021 at 19:33)</a>:</h4>
<p><span aria-label="shrug" class="emoji emoji-1f937" role="img" title="shrug">:shrug:</span> looks like it exists for ever.</p>



<a name="241707308"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241707308" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241707308">(Jun 06 2021 at 19:37)</a>:</h4>
<p>Oh, but there's no inbounds version of this, though.</p>



<a name="241707362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241707362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241707362">(Jun 06 2021 at 19:38)</a>:</h4>
<p>So you would only be able to make a wrapping_offset equivalent, and not the regular offset.</p>



<a name="241707819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241707819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241707819">(Jun 06 2021 at 19:50)</a>:</h4>
<p>You could probably still make <code>.offset</code>, <code>gep</code> is a strict superset of <code>gep inbounds</code> in llvm, IIRC.</p>



<a name="241707964"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241707964" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241707964">(Jun 06 2021 at 19:54)</a>:</h4>
<p>In terms of situations where it is applicable, yes. But it would also penalize alias analysis significantly. To the point I bet that in most cases just using scalar gepi would still be more beneficial.</p>



<a name="241709698"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241709698" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241709698">(Jun 06 2021 at 20:37)</a>:</h4>
<p><span class="user-mention" data-user-id="281757">@Jubilee</span> Out of curiosity, MVP API for what?</p>



<a name="241710620"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241710620" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241710620">(Jun 06 2021 at 21:00)</a>:</h4>
<p><span class="user-mention silent" data-user-id="123586">nagisa</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F/near/241707308">said</a>:</p>
<blockquote>
<p>Oh, but there's no inbounds version of this, though.</p>
</blockquote>
<p>That's not true, they just don't have an example for <code>inbounds</code> on a vector of pointers. The docs specifically mention:</p>
<blockquote>
<p>In cases where the base is a vector of pointers, the inbounds keyword applies to each of the computations element-wise.</p>
</blockquote>



<a name="241727984"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly%20how%20evil%20is%20pointer%20arith%3F/near/241727984" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F.html#241727984">(Jun 07 2021 at 04:37)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Exactly.20how.20evil.20is.20pointer.20arith.3F/near/241709698">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="281757">Jubilee</span> Out of curiosity, MVP API for what?</p>
</blockquote>
<p>presumably the Portable SIMD, some sort of scatter/gather related work.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>